Re: [DNSOP] New draft on delegation revalidation

["Giovane C. M. Moura" <[e-mail]>]

> I meant servers within the child (or parent) NS set had different NS
> sets configured in them, i.e. yet another level of mismatch. Maybe
> that's not worth investigating, but I'm pretty sure I've come across
> such misconfigurations in the past.

Oh now I get it.
We did only with a sample of 1% of .org domains (10k), only looking at
different NSes at the child level. We found 2% of them having
inconsistencies.

See on the last paragraph of section 3 [0]:

"Note that the OpenINTEL platform performs the measurements choosing
one of the child authoritative nameservers. To verify how often sibling
name servers have different configurations (child-child delegation
inconsistency), we execute a measurement on a random sample of ∼ 1% of
.org domains (10k domains). The measurement suggests that ∼ 2% of total
parent-child delegation inconsistency cases also have child-child
delegation inconsistencies, meaning that our results give a lower bound
for the problem of parent-child mismatch. "

/giovane


[0]
https://www.sidnlabs.nl/downloads/53BNt9EPxZQOCHYjqWhYfR/7295d79a207afc79cab6309d40a15a76/When_parents_and_children_disagree_Diving_into_DNS_delegation_inconsistency.pdf